Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is published by COZ CLUB CONSULTING PRIVATE LIMITED, a company incorporated under the laws of India and having its registered office at Vadodara, Gujarat ("COZ CLUB", "we", "us" or "our"), in connection with COZ COMPASS, our Global Capability Center (GCC) as-a-service offering, and the website available at www.cozcompass.com (the "Website").

We respect the privacy of every person who visits the Website or contacts us through it, and we are committed to handling personal data responsibly, transparently and in accordance with applicable Indian law, including the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") together with the Digital Personal Data Protection Rules, 2025, as and when their provisions are brought into force.

This Policy explains what information we collect, how we collect and use it, with whom we share it, how long we keep it, how we protect it, and the rights and choices available to you. Please read this Policy together with any proposal, statement of work or service agreement you enter into with COZ COMPASS.

2. Applicability

This Policy applies to: (a) visitors to the Website; and (b) any individual who submits an enquiry, requests a consultation, or otherwise provides personal data to us through the Website, including on behalf of an organisation ("you" or "your").

Where you submit an enquiry on behalf of a company or other entity, this Policy applies to the personal data of the individuals connected with that entity (such as its founders, employees or representatives) whose details are provided to us. By providing another individual's personal data to us, you confirm that you are authorised to do so and have made this Policy available to that individual.

If you have signed a proposal, statement of work or service agreement with COZ COMPASS, this Policy supplements that agreement. In case of any conflict between this Policy and a signed agreement, the signed agreement will prevail to the extent of the conflict, except where applicable data protection law requires otherwise.

3. Information We Collect

We collect only such information as is reasonably necessary to respond to your enquiry, understand your GCC requirements, and operate the Website. The categories of information we may collect are:

• Identity and contact information, your name, business email address, business phone number, and company name, submitted through our contact form.
• Enquiry information, the details of your requirements that you choose to share with us in the message field of the contact form, and any follow-up correspondence.
• Usage and technical information, IP address, device and browser type, pages visited, and similar technical data collected automatically when you use the Website through analytics tooling.
• Communications, correspondence, queries and feedback that you send to us by email or otherwise.

It may be noted that COZ COMPASS does not require, and you should not submit through the Website, financial records, bank or payment credentials, client-confidential information, or any sensitive personal information that is not necessary for the purposes described in this Policy. If any such information is inadvertently submitted, you may write to us at contact@cozclub.com and we will take reasonable steps to remove it.

4. How We Collect Information

We collect information in the following ways:

• Directly from you, when you submit the contact form on the Website or otherwise correspond with us by email or phone.
• Automatically, through analytics tooling and similar technologies when you use the Website, as described in Section 8.

5. Purpose of Processing

We use your information only for the following purposes:

• to respond to your enquiry and assess your GCC requirements;
• to schedule and conduct consultations and follow-up discussions with you;
• to prepare and share proposals, quotes or engagement documents relevant to your enquiry;
• to send you service-related communications relating to your enquiry or engagement;
• to maintain the security and integrity of the Website and prevent fraud and misuse;
• to respond to your queries and requests;
• to improve the Website and our services, including through aggregated and anonymised analytics; and
• to comply with applicable law, and to establish, exercise or defend legal claims.

We will not use your personal data for any purpose that is incompatible with the purposes described above without informing you and, where required by law, obtaining your consent.

6. Consent and Withdrawal of Consent

We process your personal data on the basis of consent, your consent will be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action, for example, by submitting the contact form on the Website.

You may withdraw your consent at any time, with effect for the future, by writing to contact@cozclub.com. Withdrawing consent is as simple as giving it. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and will not affect processing that we are permitted or required to carry out under applicable law without consent.

7. Sharing with Service Providers and Third Parties

We may engage service providers to operate the Website and support our activities, such as website hosting and maintenance vendors, email delivery providers, and analytics providers. These providers process information only on our instructions, only to the extent necessary to perform their services, and under obligations of confidentiality and data protection.

We may also disclose information: (a) where required by law, or pursuant to an order or direction of a court, tribunal, government agency or regulator; (b) to protect the rights, property or safety of COZ COMPASS, its personnel or the public; and (c) in connection with a bona fide reorganisation, merger or transfer of COZ COMPASS's business, subject to the successor honouring this Policy.

COZ COMPASS does not, at any point, rent or trade your personal data to any third party.

8. Cookies, Analytics and Website Technologies

The Website uses cookies and similar technologies. Essential cookies are necessary for the Website to function. Analytics and preference cookies help us understand how the Website is used and improve it; these are used on the basis of your consent, which you may give or decline through the cookie notice displayed on the Website and may change at any time through your browser or cookie settings. Disabling certain cookies may affect the functioning of parts of the Website. Analytics data is used in aggregated form and is not used to make decisions about individual visitors.

9. Data Retention

We retain personal data only for as long as it is needed for the purposes described in this Policy. In general: (a) enquiry and correspondence records are retained for the duration of our engagement discussions and for a reasonable period thereafter; (b) records that we are required to retain under applicable law (including tax, corporate and information technology laws) are retained for the periods prescribed by such law; and (c) usage logs are retained for the periods required or permitted under applicable law for security and legal purposes.

When personal data is no longer required and no legal retention obligation applies, we will delete it or irreversibly anonymise it. If you withdraw consent, we will erase your personal data within a reasonable time, subject to legal retention requirements and our legitimate need to preserve records of concluded communications.

10. Data Security

We adopt reasonable security safeguards, appropriate to the nature of the data we hold, to protect personal data against unauthorised access, disclosure, alteration, loss and misuse. These include access controls, secure hosting arrangements, periodic review of security practices, and contractual security obligations on our service providers, consistent with the standards contemplated under the Information Technology Act, 2000 and the DPDP Act.

No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that affects you, we will notify you and the relevant authority in the manner and within the timelines required under applicable law.

11. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Right to access, to obtain a summary of the personal data we hold about you and of the processing activities undertaken with respect to it;
• Right to correction and updating, to have inaccurate or incomplete personal data corrected, completed or updated;
• Right to erasure, to have your personal data erased where it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements;
• Right to withdraw consent, as described in Section 6;
• Right to grievance redressal, to raise a grievance at contact@cozclub.com, and thereafter, if unresolved, with the Data Protection Board of India in accordance with the DPDP Act once the relevant provisions are in force; and
• Right to nominate, to nominate another individual to exercise your rights in the event of your death or incapacity, in the manner prescribed under applicable law.

You may exercise these rights by writing to contact@cozclub.com. We may verify your identity before acting on a request, and we will respond within the timelines prescribed under applicable law.

12. Children's Privacy and Age Restriction

The Website is intended solely for use by individuals who are at least 18 years of age and are engaged in business or professional activities. We do not knowingly collect personal data of persons under 18 years of age. If we become aware that such data has been collected, we will delete it. If you believe that a person under 18 has provided personal data to us, please write to contact@cozclub.com.

13. Changes to this Privacy Policy

We may update this Policy from time to time to reflect changes in law, technology or our practices. The updated Policy will be published on the Website with a revised "Last Updated" date, and where the changes are material, we will notify you by email where we have your contact details. Your continued use of the Website after an update takes effect will signify your acceptance of the updated Policy, except where applicable law requires us to obtain your fresh consent.